In talking with big-time data shops we have learned that the best approach is to train users to handle data correctly, and in order to accomplish that you need to train users how to recognize sensitive information (another large organization leader said that sensitive info is like obscene materials - as Justice Stewart stated - really difficult to define, but he knew it when he saw it).